How Windows 2000 Resets Computer Passwords

This article explains the automated mechanism Microsoft Windows 2000 uses to change and synchronize domain computer account passwords. In a Windows 2000 Active Directory domain, member workstations and servers automatically rotate their computer account passwords on a predefined schedule to maintain secure channel communication with domain controllers without requiring manual administrative intervention.

The Trigger Mechanism

By default, the Netlogon service on a Windows 2000 computer initiates an automatic computer account password change every 30 days. This schedule is governed by the client computer's local registry settings, specifically the MaximumPasswordAge entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters.

If the client is offline when the 30-day interval expires, the change attempt is deferred until the machine next boots up and successfully connects to the network.

Secure Channel Negotiation

The computer account password is used to establish and authenticate the secure channel—a communication link between the client and a domain controller (DC) used for pass-through authentication and remote procedure calls (RPC).

Before initiating a password reset:

  1. The client's Netlogon service uses the DC Locator service to locate an accessible domain controller.
  2. The client establishes a secure RPC session with the DC using its current computer account credentials.

Password Generation and Encryption

  1. Generation: The client-side Local Security Authority (LSA) generates a new random password. In Windows 2000, this is typically a 120-character pseudo-random string.
  2. Encryption: The client encrypts the newly generated password using an encryption key derived from the current session key of the established secure channel.

Transmission and Execution

The password update process follows a two-phase commit pattern to ensure the client and domain controller remain synchronized:

  1. RPC Request: The client calls the NetrServerPasswordSet2 (or fallback NetrServerPasswordSet) function via RPC, sending the encrypted new password to the domain controller over the secure channel.
  2. Domain Controller Update:
    • The authenticating domain controller receives the request, decrypts the payload using the session key, and verifies the client's identity.
    • The DC writes the new password to the computer account's unicodePwd attribute within its local Active Directory database.
    • The DC sends a success response back to the client.
  3. Local Storage:
    • Only after receiving confirmation from the domain controller does the client commit the new password to its local storage.
    • The new password is stored in the local LSA Secrets repository within the registry.

Replication

Once successfully updated on the authenticating domain controller, the modified computer account password replicates to all other domain controllers in the domain through standard Active Directory replication routines. If the computer subsequently communicates with a different domain controller before replication completes, the new domain controller can verify the credentials by checking with the Primary Domain Controller (PDC) emulator.